Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash) in the filename.

- Fix local file access bug in internal http server *     Optimized implementation of the ip_set module

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-36 (MLDonkey: Information disclosure)

    Michael Peselnik reported that src/utils/lib/url.ml in the web     interface of MLDonkey does not handle file names with leading double     slashes properly.
  Impact :

    A remote attacker could gain access to arbitrary files readable by the     user running the application.
  Workaround :

    Disable the web interface or restrict access to it.

It has been discovered that mldonkey, a client for several P2P networks, allows attackers to download arbitrary files using crafted requests to the HTTP console.

ID	Name	Product	Family	Severity
37264	Fedora 10 : mldonkey-3.0.0-1.fc10 (2009-2758)	Nessus	Fedora Local Security Checks	medium
36002	GLSA-200903-36 : MLDonkey: Information disclosure	Nessus	Gentoo Local Security Checks	medium
35991	Debian DSA-1739-1 : mldonkey - path traversal	Nessus	Debian Local Security Checks	medium
35934	Fedora 9 : mldonkey-3.0.0-1.fc9 (2009-2703)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-0753

high

Tenable Plugins

medium

medium

medium

medium